Enterprise risk management

ABSTRACT

The invention relates to a method for managing risk of an enterprise. The method steps include generating, using risk survey responses, risk panels for first level risk survey items; presenting the risk panels for each of the first level risk survey items; receiving a selection of a first risk panel of the risk panels for a first level risk survey item; presenting, based on the selection, a second risk panel of the risk panels for second level risk survey items; receiving, using the second risk panel, additional risk survey responses for one of the second level risk survey items; updating, based on the additional risk survey responses and using a computer processor, the risk panels for the first level risk survey item to generate revised risk panels; and presenting the revised risk panels for the first level risk survey items.

CROSS-REFERENCE TO RELATED APPLICATION

This application is related to U.S. patent application Ser. No.13/193,442, filed on Jul. 28, 2011, and entitled: “REAL TIME DATAAGGREGATION FOR INFORMED USER INPUT IN SOCIAL SURVEYS” by Justin R.Ruthenbeck, Janet Patrice Nasburg, and Linda C. Contarino. U.S. patentapplication Ser. No. 13/193,442 is hereby incorporated in its entirety.

BACKGROUND

The task of managing one or more risks for an enterprise (e.g., acorporation, a non-profit group, an academic institution, a governmententity, a household, an individual, a trust, an estate) may be acumbersome and involved process. Risk management involves, among othertasks, identifying a risk, assessing the risk, developing a plan tomanage the risk, and assessing the effectiveness of the plan.

In some cases, a risk may be the same from enterprise to enterprise.However, managing such a risk may involve elements that are unique to aparticular enterprise, and so a plan for managing the risk may betailored for the enterprise. Further, one or more risks of an enterprisemay be the responsibility assigned to one or more particular peopleacross different business units of an enterprise. In such a case,sharing of information and coordination of efforts may be importantfactors in managing the risk across an enterprise.

SUMMARY

In general, in one aspect, the invention relates to a method formanaging risk of an enterprise at both the enterprise and the differentbusiness unit of the enterprise levels. The method steps include (1)generating, using a plurality of risk survey responses, a plurality ofrisk panels for a plurality of first level risk survey items, (2)presenting the plurality of risk panels for each of the plurality offirst level risk survey items, (3) receiving a selection of a first riskpanel of the plurality of risk panels for a first level risk survey itemof the plurality of first level risk survey items, (4) presenting, basedon the selection, a second risk panel of the plurality of risk panelsfor a plurality of second level risk survey items, (5) receiving, usingthe second risk panel, additional risk survey responses for one of thesecond level risk survey items of the plurality of second level risksurvey items, (6) updating, based on the additional risk surveyresponses and using a computer processor, the plurality of risk panelsfor the first level risk survey item to generate a plurality of revisedrisk panels, and (7) presenting the plurality of revised risk panels forthe plurality of first level risk survey items.

In general, in one aspect, the invention relates to a system formanaging risk of an enterprise at both the enterprise and the differentbusiness unit of the enterprise levels. The system includes a computerprocessor, a survey analyzer, and an enterprise risk manager, which areall operatively connected. The survey analyzer executes on the computerprocessor and is configured to: (1) receive a plurality of risk surveyresponses, (2) generate, based on the plurality of risk surveyresponses, a plurality of risk panels for each of a plurality of firstlevel risk survey items, (3) receive, using a first risk panel of theplurality of risk panels, additional risk survey responses, and (4)update, based on the additional risk survey responses, the plurality ofrisk panels for the first level risk survey item to generate a pluralityof revised risk panels. The enterprise risk manager executes on thecomputer processor and is configured to: (1) present the plurality ofrisk panels for the plurality of first level risk survey items, (2)receive a selection of a second risk panel of the plurality of riskpanels for a first level risk survey item of the plurality of firstlevel risk survey items, (3) present, based on the selection, the firstrisk panel of the plurality of risk panels for a plurality of secondlevel risk survey items, and (4) present the plurality of revised riskpanels for the plurality of first level risk survey items.

In general, in one aspect, the invention relates to a computer readablemedium comprising computer readable program code embodied therein forperforming a method for managing risk of an enterprise at both theenterprise and the different business unit of the enterprise levels. Themethod steps include (1) generating, using a plurality of risk surveyresponses, a plurality of risk panels for a plurality of first levelrisk survey items, (2) presenting the plurality of risk panels for eachof the plurality of first level risk survey items, (3) receiving aselection of a first risk panel of the plurality of risk panels for afirst level risk survey item of the plurality of first level risk surveyitems, (4) presenting, based on the selection, a second risk panel ofthe plurality of risk panels for a plurality of second level risk surveyitems, (5) receiving, using the second risk panel, additional risksurvey responses for one of the second level risk survey items of theplurality of second level risk survey items, (6) updating, based on theadditional risk survey responses, the plurality of risk panels for thefirst level risk survey item to generate a plurality of revised riskpanels, and (7) presenting the plurality of revised risk panels for theplurality of first level risk survey items.

Other aspects of the invention will be apparent from the followingdescription and the appended claims.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 shows a system in accordance with one or more embodiments of theinvention.

FIGS. 2 and 3 each show a flowchart in accordance with one or moreembodiments of the invention.

FIGS. 4A through 11C show examples of a graphical interface inaccordance with one or more embodiments of the invention.

FIG. 12 shows a computer system in accordance with one or moreembodiments of the invention.

DETAILED DESCRIPTION

Specific embodiments of the invention will now be described in detailwith reference to the accompanying figures. Like elements in the variousfigures are denoted by like reference numerals for consistency.

In the following detailed description of embodiments of the invention,numerous specific details are set forth in order to provide a morethorough understanding of the invention. However, it will be apparent toone of ordinary skill in the art that the invention may be practicedwithout these specific details. In other instances, well-known featureshave not been described in detail to avoid unnecessarily complicatingthe description.

In general, embodiments of the invention provide a system and method tomanage enterprise risk. Specifically, embodiments of the inventionprovide a user interface that allows a user (e.g., an owner of a risksurvey item, an officer of an enterprise) to seamlessly integrate riskidentification, risk assessment, and risk management planning for one ormore risk survey items. Embodiments of the invention may generate andpresent one or more risk summary panels to display risk survey items,plans, risk measures, and other information associated with anenterprise risk management system. In one or more embodiments of theinvention, a risk panel (or, simply, a panel) is a graphical userinterface (GUI) that includes one or more components. A component of aGUI may be passive (i.e., configured to only display information) oractive (i.e., configured to both display information and receive inputfrom a user). An active component of a GUI may be configured, forexample, to receive data, receive a selection, cause a different riskpanel to be presented, and save information. Information may be a firstlevel risk survey item, a second level risk survey item, a risk surveyresponse, or any other suitable information associated with a risk item.

FIG. 1 shows a diagram of a system in accordance with one or moreembodiments of the invention. The system includes a computer system(102) and a number of users (e.g., user 1 (150), user N (152)). Thecomputer system (102) includes a risk assessment application (104), astorage repository (130), a processor (120), memory (122), anapplication interface (126), and, optionally, a security module (128).The risk assessment application (104) includes an enterprise riskmanager (106), a survey analyzer (108), a survey generator (110), and asurvey input module (112). The storage repository (130) includes surveylists (132), survey results (134), and thresholds (136). Each of thesecomponents is described below. Embodiments of the invention are notlimited to the configuration shown in FIG. 1 and discussed herein.

In one or more embodiments of the invention, the computer system (102)is implemented according to a client-server topology. The computersystem (102) may correspond to enterprise software running on one ormore servers, and in some embodiments may be implemented as apeer-to-peer system, or resident upon a single computing system. Inaddition, the computer system (102) may be accessible from othermachines using one or more application programming interfaces and/oruser interfaces (not shown). In one or more embodiments of theinvention, the computer system (102) may be accessible over a networkconnection (not shown), such as the Internet, by one or more users(e.g., advertiser, user, financial transaction source, etc.). Further,information and/or services provided by the computer system (102) mayalso be stored and accessed over the network connection (e.g., theInternet) with wired and/or wireless segments. Further, in one or moreembodiments, the invention may also be implemented as a stand aloneapplication, a web application, a browser extension, or otherapplication capable of linking users with a computer system.

In one or more embodiments of the invention, the computer system (102)may be a local computer system of a user (e.g., user 1 (150), user N(152)). In such embodiments, the computer system (102) may, optionally,not be implemented using a client-server topology. For example, thecomputer system (102) may correspond to a laptop computer, desktopcomputer, mobile device, or another type of computing device, orcombination of multiple computing devices. Additionally oralternatively, the computer system (102) may be a distributed computersystem and/or multi-processor computer system in which the computersystem includes multiple distinct computing devices.

Continuing with FIG. 1, a user (e.g., user 1 (150), user N (152))provides risk assessment information, which is aggregated and presentedto the user and/or other users in accordance with one or moreembodiments of the invention. For example, a user (e.g., user 1 (150),user N (152)) may create a risk survey item, select a risk survey item,provide responses to a risk survey item (e.g., ratings regarding therisk survey item, a plan to mitigate the risk survey item, progressregarding a plan to mitigate the risk survey item), collaborate withother users responsible for the risk survey item, and receive a summarypresentation of the risk survey item. A user (e.g., user 1 (150), user N(152)) may be a person or group responsible for managing a risk surveyitem, an officer of an enterprise, a member of a risk managementcommittee for an enterprise, or some other entity responsible formanaging and/or reporting risk.

In one or more embodiments of the invention, a user (e.g., user 1 (150),user N (152)) may interact with the computer system (102). Specifically,a user (e.g., user 1 (150), user N (152)) may send, for example,responses to risk survey items, user preferences, settings, and/orfeedback to the computer system (102). A response to a risk survey itemmay be any information (e.g., a rating, a risk mitigation plan, progressfor a risk mitigation plan, action items) associated with a risk surveyitem. A user (e.g., user 1 (150), user N (152)) may send responses torisk survey items, user preferences, settings, and/or feedback to thecomputer system (102) in a number of manners (e.g., modes ofcommunication), including but not limited to the mail, a telephone,email, fax, short message service, over the Internet, some othersuitable mode for sending information, or any combination thereof.

Further, a user (e.g., user 1 (150), user N (152)) may receive, forexample, one or more risk survey panels and other risk-relatedinformation from the computer system (102). The responses to risk surveyitems, user preferences, settings, and/or feedback may be deliveredautomatically (e.g., according to a default setting, a user preference,an occurrence of an event) or on demand, for example, in response to arequest from the computer system (102). The computer system (102) mayinteract with a user (e.g., user 1 (150), user N (152)) in the samemanner that a user (e.g., user 1 (150), user N (152)) interacts with thecomputer system (102), or using different modes of communication. A user(e.g., user 1 (150), user N (152)) may use a user system (not shown)(discussed below) to interact with the computer system (102) usingsoftware (not shown) in accordance with one or more embodiments of theinvention.

Continuing with FIG. 1, the computer system (102) is configured tointeract with a user (e.g., user 1 (150), user N (152)) using anapplication interface (126) in accordance with one or more embodimentsof the invention. Specifically, the application interface (126) of thecomputer system (102) is configured to receive input from and sendoutput to a user (e.g., user 1 (150), user N (152)). A user system mayinclude an interface to receive data from and send data to the computersystem (102). Examples of an interface may include, but are not limitedto, a graphical user interface (GUI), an application programminginterface, a keyboard, a monitor, a mouse, a web service, a dataprotocol adapter, some other hardware and/or software, or any suitablecombination thereof.

In one or more embodiments of the invention, the information received bythe application interface (126) includes, but is not limited to,responses to risk survey items, user preferences, settings, andfeedback. The information sent by the application interface (126) mayinclude, but is not limited to, risk panels, risk survey items, a planfor a risk survey item, a notification, and a request for information.The information sent by the application interface (126) may specify, butis not limited to, a user (e.g., user 1 (150), user N (152)), a UniformResource Identifier (URI) (e.g., a Uniform Resource Locator (URL), a webaddress, etc.), a risk survey item, some other software or source ofinformation, or any suitable combination thereof.

In one or more embodiments of the invention, the information (i.e.,data) transferred among the application interface (126) and a user(e.g., user 1 (150), user N (152)) corresponds to metadata associatedwith, for example, responses to risk survey items, user preferences,settings, feedback, risk panels, risk survey items, plans for risksurvey items, notifications, and/or requests for information. In thiscase, the metadata may describe the data specified in the responses torisk survey items, user preferences, settings, feedback, risk panels,risk survey items, plans for risk survey items, notifications, and/orrequests for information (i.e., the metadata may provide context for thespecified data). In one or more embodiments of the invention, thecomputer system (102) is configured to support various data formatsprovided by a user (e.g., user 1 (150), user N (152)).

Continuing with FIG. 1, the computer system (102) is configured toretrieve and store survey lists (132), survey results (134), andthresholds (136). More specifically, the computer system (102) may beconfigured to use the enterprise risk manager (106) to retrieve andstore survey lists (132), survey results (134), and thresholds (136) inthe storage repository (130) in accordance with one or more embodimentsof the invention. In one or more embodiments of the invention, access tothe storage repository (130) by a user (e.g., user 1 (150), user N(152)), as well as to specific elements (i.e., survey lists (132),survey results (134), and thresholds (136)) within the storagerepository (130), may be based on authentication of the user using thesecurity module (128) (described below).

In one or more embodiments of the invention, a survey list (132) is acollection of multiple risk surveys. A risk survey may include one ormore risk survey items that are displayed to a user (e.g., user 1 (150),user N (152)). A risk survey item may be any information associated withrisk management for an enterprise. Examples of a risk survey item mayinclude, but are not limited to, a name of a risk, a description of arisk, a question regarding a risk, a plan to mitigate a risk, a task ofa plan, a due date of a plan, and a risk measure.

In one or more embodiments of the invention, a risk survey item may beclassified as a first level risk survey item or a second level risksurvey item. In one or more embodiments, a first level risk survey itemis a high-level (summary) description of an identified risk for anenterprise. Examples of a first level risk survey item may include, butare not limited to, a name of a risk (e.g., offering quality, businessinterruption, financial management, employees, competitors), a riskmeasure expressed as a number, word, or symbol, and a name of a group(risk category). First level risk survey items may be organized by riskcategories. For example, a group of first level risk survey itemscategorized as “strategic” may include, but is not limited to,employees, offering (e.g., product) quality.

In one or more embodiments of the invention, a second level risk surveyitem represents one or more risk survey items that pertain to aparticular first level risk survey item. Specifically, a second levelrisk survey item may be a risk survey item that supports, describes,explains, or otherwise corresponds to a first level risk survey item.For example, if the first level risk survey item is “offering quality,”then second level risk survey items may include, but are not limited to,a list of selectable issues (e.g., failure to expand customer relations,inadequate response to customer needs, lack of design and qualitystandards, and supply or distribution channels poor performance), adescription of the first level risk survey item, instructions, and oneor more questions (e.g., likelihood, impact).

In one or more embodiments of the invention, the survey results (134)stored in the storage repository (130) are responses to the risksurveys. Survey results (134) may include the actual (unformatted and/orunedited) response(s) to a risk survey (which may include one or morefirst and/or second level risk survey items) received from each user(e.g., user 1 (150), user N (152)). The survey results (134) may alsoinclude responses that have been processed by the enterprise riskmanager (106) (described below). For example, the survey results (134)may include the risk summary information, continually updated asadditional responses are received and processed, used for the riskpanels (described below with respect to FIGS. 4A and 4B). Further, thesurvey results (134) may include one or more plans, including details ofeach plan, used to mitigate one or more risk survey items. A plan mayalso include actions taken to address a risk survey item as well as anevaluation of the effectiveness of one or more actions taken.

In one or more embodiments of the invention, the thresholds (136) storedin the storage repository (130) have a word description and one or morevalues or ranges of values that define a boundary used to determine anamount of risk associated with a risk survey item (e.g., first levelrisk survey item, second level risk survey item). For example, for“business interruption,” a first level risk survey item, a threshold mayhave a word description of “impact” and have a value of 2.2. In such acase, an impact score of 2.2 or greater for the “business interruption”risk survey item may mean that the “business interruption” risk surveyitem has a significant influence on the growth or decline of theenterprise and should be managed closely. A threshold value may be anumber, a date, or any other suitable indication of a boundary.

Access to one or more survey lists (132), the survey results (134),and/or the thresholds (136) stored in the storage repository (130) maybe based on a particular user (e.g., user 1 (150), user N (152)), theposition held by a user within the enterprise, a level of securityaccess held by a user, or some other suitable identification of a user.For example, a manager of a business unit within the enterprise may onlyhave access to certain first level risk survey items (as well as thecorresponding second level risk survey items), while the chief executiveof the enterprise may have access to all first level risk survey itemsand all second level risk survey items. As another example, twodifferent users may have access to the same restricted group of firstand corresponding second level risk survey items, where one user hasread-only access and the other user has full rights (e.g.,add/delete/modify a first level risk survey item, a second level risksurvey item, a threshold) In one or more embodiments of the invention, aparticular user (e.g., user 1 (150), user N (152)) may have accessrights to modify and/or delete survey results submitted by thatparticular user.

Continuing with FIG. 1, the storage repository (130) is a persistentstorage device (or set of devices) that stores software and data used toassess and manage one or more risks of an enterprise. In one or moreembodiments of the invention, the storage repository (130) is configuredto store the survey lists (132), survey results (134), and thresholds(136) in accordance with one or more embodiments of the invention.Examples of a storage repository (130) include, but are not limited to,a database (or a number of databases), a file system, a hard drive, someother form of data storage, or any suitable combination thereof. Thestorage repository (130) may be located on multiple physical machines,each storing all or a portion of the survey lists (132), survey results(134), and thresholds (136). Each storage unit or device may bephysically located in the same or different geographic location.

The storage repository (130) may be operatively connected to the riskassessment application (104). In one or more embodiments of theinvention, the risk assessment application (104) includes functionalityto assess and manage one or more risks of an enterprise. Morespecifically, the risk assessment application (104) may be configured toreceive, for example, risk survey responses, user preferences, settings,and feedback from the application interface (126) and store the surveylists, survey results, and thresholds in the storage repository (130).The functions of the risk assessment application (104) may be performedon a single computing device or on multiple computing devices. When thefunctions of the risk assessment application (104) are performed onmultiple computing devices, a number of configurations and/or frameworksmay be used. The configurations and/or software frameworks may bedesigned to work with multiple data nodes and large quantities of data.One or more calculations performed by one or more components of the riskassessment application (104) may be performed on multiple machinesoperating in parallel, where the results from each machine may becombined to generate a result to the one or more calculations.

In one or more embodiments of the invention, the enterprise risk manager(106) of the risk assessment application (104) is configured tocoordinate and provide an interface between the survey analyzer (108),the survey generator (110), the survey input module (112), and,optionally, the security module (128). Specifically, the enterprise riskmanager (106) may be configured to coordinate the transfer of, forexample, risk survey responses, user preferences, settings, and risksurvey items between the application interface (126), the storagerepository (130), and the other components of the risk assessmentapplication (104).

The interface provided by the enterprise risk manager (106) may includea GUI, in the form of one or more risk panels, configured to acceptinputs (e.g., keyboard input, cursor input, voice commands, etc.) fromthe user (e.g., user 1 (150), user N (152)) and produce outputs using adisplay screen, a printer, audio speakers, etc. The enterprise riskmanager (106) may direct the activities of the components (e.g.,application interface (126), storage repository (130)) in the computersystem (102) and translate data from the format of one component to theformat of another component, as required.

Further, the enterprise risk manager (106) may be configured to retrievethe survey lists (132), survey results (134), and thresholds (136) from,and send survey lists, survey results, and thresholds to, the storagerepository (130) for use by the enterprise risk manager (106) or byother components of the risk assessment application (104). Theenterprise risk manager (106) may also be configured to retrieve surveylists (132), survey results (134), and thresholds (136) from the storagerepository (130) to be sent to a user (e.g., user 1 (150), user N(152)).

Continuing with FIG. 1, the enterprise risk manager (106) is configuredto present one or more risk panels to a user. Each risk panel isassociated with a risk survey item and may be generated by the surveyanalyzer (108) (described below). Further, each risk panel may includeone or more risk measures associated with the risk survey item. In oneor more embodiments of the invention, the enterprise risk manager (106)is also configured to receive a selection of a risk panel. The riskpanel may be associated with a first level risk survey item.

Further, the one or more risk panels presented by the enterprise riskmanager (106) may be based on one or more characteristics associatedwith a user (e.g., user 1 (150), user N (152)). A characteristic may beany information associated with a user. Examples of a characteristic mayinclude, but are not limited to, a position within the enterprise,security clearance, and employment status. A user may be identified inone of a number of ways, including but not limited to a name, adepartment, login information, and an employee identification number. Byway of example, a user (e.g., user 1 (150), user N (152)) may beidentified, based on characteristics of the user stored in the storagerepository (130), as the chief executive of an enterprise, in which caseall risk panels are shown to that particular user by the enterprise riskmanager (106). As another example, a user may be identified as a managerof a portion of a business unit of the enterprise, in which case onlythe risk panels associated with that portion of the business are shownto that particular user by the enterprise risk manager (106).

The enterprise risk manager (106) may also present one or more risksurvey items in a hub-and-spoke format. For example, when the risksurvey items are first level risk survey items, one of the first levelrisk survey items is the hub, while the remainder of the first levelrisk survey items are each connected to the hub by a spoke. In one ormore embodiments of the invention, the hub-and-spoke format may bemodified using the enterprise risk manager (106). For example, theenterprise risk manager (106) may receive a selection of a risk surveyitem, which was originally presented as being connected to the hub by aspoke, as a new hub. In such a case, the enterprise risk manager (106)may modify the hub-and-spoke format by presenting the newly selectedrisk survey item as the new hub and presenting the risk survey item thatwas the old hub as being connected (along with the other risk surveyitems) to the new hub by a spoke.

In one or more embodiments of the invention, the enterprise risk manager(106) is further configured to receive a selection of a risk panel. Theselection of the risk panel may be for a risk survey item (e.g., a firstlevel risk survey item) or a risk component of a risk survey item. Theenterprise risk manager (106) may also be configured to present one ormore second level risk survey items in response to the selection of therisk panel. In one or more embodiments of the invention, the one or moresecond level risk survey items presented by the enterprise risk manager(106) may be associated with the risk survey item of the risk panel.

In one or more embodiments of the invention, the enterprise risk manager(106) is further configured to present one or more revised risk panels.In other words, as a user provides a risk survey response that changes alist of risk survey items and/or a risk measure (as calculated by thesurvey analyzer (108), as described below), the enterprise risk manager(106) dynamically presents the change as a revised risk panel.

In one or more embodiments of the invention, a risk panel is customizedby a user (e.g., user 1 (150), user N (152)). Specifically, theenterprise risk manager (106) may be configured to receive one or moreuser preferences with regard to a risk panel, effectively customizingthe appearance of the risk panel for the user. The enterprise riskmanager (106) may also be configured to receive one or more userpreferences with regard to other risk survey items (e.g., second levelrisk survey items). Those skilled in the art, having the benefit of thisdetailed description, will appreciate that many examples of panelcustomization exist.

In one or more embodiments of the invention, the enterprise risk manager(106) is further configured to send one or more notifications to a user(e.g., user 1 (150), user N (152)). A notification may be an alert tonotify one or more users of an issue related to one or more risk surveyitems. For example, a notification may notify a user that a due date tocomplete a task associated with a plan to mitigate a risk associatedwith a risk survey item has passed. As another example, a notificationmay notify a user that a value of a risk measure exceeds a thresholdvalue.

In one or more embodiments of the invention, the enterprise risk manager(106) is further configured to map one or more first level risk surveyitems to a general risk heading. In other words, the enterprise riskmanager (106) may organize the first level risk survey items. Thegeneral risk headings may be created by the enterprise risk manager(106). Further, the enterprise risk manager (106) may present the one ormore general risk headings and the corresponding first level risk surveyitems according to the mapping.

In one or more embodiments of the invention, the survey analyzer (108)of the risk assessment application (104) is configured to receive one ormore risk survey responses from one or more users (e.g., user 1 (150),user N (152)). A risk survey response is any information provided by auser (e.g., user 1 (150), user N (152)) and that relates to one or morerisk survey items. A risk survey response may be one or more selectionsof, additions of, deletions of, and/or revisions to a first and/orsecond level risk survey item, one or more selections of, additions of,deletions of, and/or revisions to a plan or an element (e.g., a task, adue date of a task) associated with a plan, Each risk survey responsemay be received by the survey analyzer (108) dynamically, such that thesurvey analyzer (108) receives a risk survey response when a user (e.g.,user 1 (150), user N (152)) submits the risk survey response.

In one or more embodiments of the invention, the survey analyzer (108)is further configured to generate one or more risk panels. Specifically,the survey analyzer (108) may be configured to select one or more firstlevel risk survey items and/or one or more second level risk surveyitems and place such risk survey items within a risk panel. As describedabove, each risk panel may be a GUI with one or more active and/orpassive components. For example, the survey analyzer (108) may generatea risk panel that includes a name of a risk as well as a value of one ormore risk measures. Examples of a risk measure include, but are notlimited to, a trend, a velocity, a metric, a likelihood, an impact, asum, and an indicator. Each summary of the one or more risk measures maybe expressed as a value (e.g., a number, a word, a symbol). A value of arisk measure may be determined by the survey analyzer (108) using astatistical analysis of one or more risk survey responses (e.g., surveyresults (134)) provided by one or more users (e.g., user 1 (150), user N(152)).

A risk panel may also provide other information associated with a risksurvey item, including but not limited to a name of the risk item, adescription of the risk item, an owner of the risk item, and a plan forthe risk item. In one or more embodiments of the invention, a risk panelis a visual element of any size and shape for dynamically capturing anddisplaying information and/or one or more risk measures (e.g., a trend,a velocity, a metric, a likelihood, an impact, a sum, an indicator)associated with one or more risk survey items.

Further, a risk panel may include any number of GUI components such as,for example, textboxes, radio buttons, drop-down lists, dynamicdisplays, checkboxes, labels, and other widgets known to those ofordinary skill in the art. The aforementioned GUI components may includeone or more risk survey items. For example, a checkbox may be coupledwith a second level risk survey item describing an issue that may berelevant to a corresponding first level risk survey item. As anotherexample, an active link may be incorporated with a risk measure shown ona risk panel for a first level risk survey item. Further, the riskmeasures displayed on a risk panel may provide risk information, usingthe value, with regard to the corresponding risk survey item. Forexample, a risk panel for the risk survey item “employees” may include anumber of dynamic displays (active GUI components), each associated witha risk measure that contains a value and, when selected by a user,presents a different risk panel showing detailed information related tothe risk measure and how the value for the risk measure is determined.

In one or more embodiments of the invention, each risk panel includesmultiple layers to describe one or more risk survey items. For example,a generated risk panel may include a primitive layer including a numberof GUI components for capturing and displaying data associated with thecorresponding risk survey item. In one or more embodiments of theinvention, the primitive layer may capture and display a number of risksurvey items (e.g., second level risk survey items). In contrast, a toplayer of a generated risk panel includes fewer GUI components for a risksurvey item than the primitive level and captures only a high level viewof the risk survey item. Many of the GUI components at the primitivelevel may correspond to a risk measure (discussed below). Those skilledin the art, having the benefit of this detailed description, willappreciate a risk panel may have any number of layers between the toplayer and the primitive layer.

In one or more embodiments of the invention, a risk panel is updateddynamically to generate a revised risk survey panel whenever a risksurvey response is received and processed. For example, if user Asubmits a risk survey response that describes 40 employees asvoluntarily leaving the employment of the enterprise to work for acompetitor of the enterprise, then the risk panels for risk survey itemssuch as “employees” and “competitor” may be updated dynamically to showthe calculated impact of the information in the risk survey response.

In one or more embodiments of the invention, the survey analyzer (108)is further configured to determine that a value of a risk measureassociated with a risk panel of the risk survey item exceeds a thresholdvalue. The survey analyzer (108) may also be configured to determinethat a due date for a task associated with a plan to mitigate a riskassociated with a risk survey item has passed.

In one or more embodiments of the invention, the survey generator (110)is configured to generate a risk survey with one or more risk surveyitems for one or more users (e.g., user 1 (150), user N (152)). The risksurvey items in a risk survey are intended to provide information toand/or solicit a response from a user. A response to a risk surveysubmitted by the user may be a risk survey response. A risk survey mayinclude one or more questions and/or open-ended statements regarding arisk survey item and/or a plan associated with a risk survey item. Arisk survey generated by the survey generator (110) may be based on anumber of factors, including but not limited to a change to a risksurvey item, a user profile, user preferences, a request by a differentuser, and/or some other factor.

In one or more embodiments of the invention, the survey input module(112) is configured to send a request to a user (e.g., user 1 (150),user N (152)) to complete a risk survey. The survey input module (112)may send the request based on a default setting, an occurrence of anevent (e.g., passage of time, release of a new risk survey), a userpreference, or some other mechanism. The request sent by the surveyinput module (112) may accompany a new risk survey. The request sent bythe survey input module (112) may also serve as a reminder for the userto complete the risk survey.

FIGS. 2 and 3 show flowcharts of a method for assessing and managingenterprise risk in accordance with one or more embodiments of theinvention. The process shown in FIGS. 2 and 3 may be used, for example,by the system of FIG. 1. While the various steps in these flowcharts arepresented and described sequentially, some or all of the steps may beexecuted in different orders, may be combined or omitted, and some orall of the steps may be executed in parallel. Further, in one or more ofthe embodiments of the invention, one or more of the steps describedbelow may be omitted, repeated, and/or performed in a different order.In addition, additional steps, omitted in FIGS. 2 and 3, may be includedin performing this method. Accordingly, the specific arrangement ofsteps shown in FIGS. 2 and 3 should not be construed as limiting thescope of the invention.

In one or more embodiments of the invention, a particular computingdevice, as described, for example, in FIG. 12 below, is used to performone or more of the steps described below with respect to FIGS. 2 and 3.

Referring to FIG. 2, in Step 202, characteristics of a user aredetermined. In one or more embodiments of the invention, userinformation is received (as through a GUI component) and compared withrecords stored for one or more users. When a match is found between theinformation received and a user record, the user characteristicsassociated with the user record are retrieved. The user information maybe login information, a password, an employee identification number, aname, a fingerprint, a scanned retina, and/or some other means ofidentification. In one or more embodiments of the invention, the user isan owner of (i.e., person responsible for) one or more risk surveyitems.

In Step 204, one or more risk panels of first level risk survey itemsare presented. The risk panels of the first level risk survey items maybe generated based on one or more of a number of factors, including butnot limited to the user characteristics and one or more risk surveyresponses. For example, when the user is the chief risk officer of anenterprise, all first level risk survey items for the enterprise may bepresented. As another example, if the user is an accountant for theenterprise, only first level risk survey items associated withaccounting may be presented. Further, each of the first level risksurvey items may be presented with one or more risk measures (e.g., aset of risk measures). A risk measure may be determined based on risksurvey responses from one or more users.

The one or more risk panels of the first level risk survey items may bepresented in one of a number of formats. For example, a risk panel ofthe first level risk survey items may be presented as groups of rowsand/or columns. As another example, a risk panel for the first levelrisk survey items may be presented in a hub-and-spoke format, where thehub is one of the first level risk survey items chosen by a user andeach of the remaining first level risk survey items are connected to thehub by a spoke. As another example, a risk panel of the first level risksurvey items may be presented in tabular form. Further, the format ofthe first level risk survey items may be based on a default setting, auser preference, or some other factor.

In Step 206, a selection of one of the first level risk survey items isreceived.

The selection may be received in the same manner in which the firstlevel risk survey items are presented. For example, if the first levelrisk survey items are presented as risk panels with a GUI, then theselection of one of the first level risk survey items may be receivedusing one or more GUI components. In one or more embodiments of theinvention, only the first level risk survey items that the user hasauthority (based on, for example, a position within the enterprise or asecurity clearance) to select are presented to the user. A selection ofa first level risk survey item may also be called a risk surveyresponse.

In Step 208, revised first level risk survey items are calculated. Therevised first level risk survey items may be calculated based on theselection by the user and/or other users. Because the method describedin this FIG. 2 is dynamic and involves multiple users across anenterprise, selections made by a user are processed when received andupdated dynamically. The first level risk survey items presented to auser at a given point in time are up-to-date based on selections thatwere previously submitted by one or more users.

In Step 210, the revised first level risk survey items are presented.The revised risk level risk survey items may be presented in a mannersimilar to presenting the first level risk survey items described abovewith respect to Step 204.

In Step 212, a determination is made as to whether a selection of adifferent risk survey item from the revised first level risk surveyitems is received. The comparison is made with respect to the selectionin Step 206. If a different risk survey item from the revised firstlevel risk survey items is received, the process reverts to Step 208. Ifa different risk survey item from the revised first level risk surveyitems is not received, the process proceeds to Step 214.

In Step 214, one or more risk panels of second level risk survey itemsare presented in response to the receiving the selection of the firstlevel risk survey item. The one or more risk panels of the second levelrisk survey items may be presented in one of a number of formats. Forexample, a risk panel of the second level risk survey items may bepresented as a list, where each of the second level risk survey items isaccompanied by a checkbox or other active components. A risk panel forthe second level risk survey items may also be presented as a table withno interactive components. Further, the format of a risk panel of thesecond level risk survey items may be based on a default setting, a userpreference, or some other factor.

In Step 216, one or more selections associated with the second levelrisk survey items are received. Each selection may be made in a mannerrequired by the GUI that presents the second level risk survey items. Inother words, in one or more embodiments of the invention, a selection ismade using an active component of a GUI of a risk panel. Examples of howa selection may be made include, but are not limited to, checking acheckbox, pushing a pushbutton, selecting an item from a dropdown list,entering a number, selecting a number, entering a date, typing text,and/or selecting a radio button. The selections may be received from auser or a number of users. A selection associated with a second levelrisk survey item may also be called a risk survey response. Each secondlevel risk survey item may be, or may be associated with, a riskmeasure.

In Step 218, risk measures of the second level risk survey items areupdated to generate updated risk measures. In one or more embodiments ofthe invention, the risk measures are updated based on the selectionsassociated with the second level risk survey items. Each risk measuremay be associated with a value so that generating an updated (revised)risk measure also generates an updated (revised) value associated withthe updated risk measure. The updated value may be a number, a range ofnumbers, a word, a symbol, or some other representation of the updatedrisk measure.

The updated risk measures may be generated using one or more algorithms.Such algorithms may be statistically based. For example, if a risksurvey response for a second level risk survey item is a number rating,the updated risk measure may incorporate the selection as an average, aweighted average (weighted, for example, based on the user (e.g.,position within the enterprise, experience within the enterprise), aperiod of time (e.g., how old the risk survey response is)) a range, atrend, or some other numerical designation. Other, non-statisticalalgorithms may also be used to generate an updated risk measure. Forexample, an algorithm may be based on calendar dates (e.g., to determineprogress of a plan to mitigate a risk survey item), text (e.g., toprocess steps required to mitigate a risk survey item), some otherfactor, or any suitable combination thereof.

In Step 220, a determination is made as to whether an updated value ofthe updated risk measures of the second level risk survey items exceedsa threshold value. The threshold value may be a number, a due date, orsome other suitable measure of risk. In one or more embodiments of theinvention, the updated value and the threshold value are of the samevalue type (e.g., number, symbol, text). An algorithm may be used torecognize and compare the updated value and the threshold value. If theupdated value exceeds the threshold value, then the process proceeds toStep 222. If the updated value does not exceed the threshold value, thenthe process ends.

In Step 222, a notification that the updated value exceeds the thresholdvalue is sent. The notification may be with regard to the second levelrisk survey item, the first level risk survey item with which the secondlevel risk survey item is associated, or both. The notification may besent to an owner of (i.e., person or entity responsible for) the risksurvey item. The notification may include a recommendation and/or actionitems to mitigate the risk survey item. The recommendation and/or actionitems may be derived from one or more of a number of sources, includingbut not limited to a plan for the risk survey item, an archived recordof the risk survey item, and another user associated with the risk item.When the notification is sent, the process ends.

Referring to FIG. 3, Steps 302 and 304 are substantially similar toSteps 202 and 204, respectively, as described above. In Step 306, aselection is received for a first level risk survey item. The selectionmay be received in the same manner in which the first level risk surveyitems are presented. For example, if the first level risk survey itemsare presented on a risk panel (e.g., a GUI), then the selection for thefirst level risk survey items may be received using an active componentof the GUI.

In one or more embodiments of the invention, only the first level risksurvey items that the user has authority (based on, for example, aposition within the enterprise or a security clearance) to select arepresented to the user. A selection for a first level risk survey itemmay be a plan for the first level risk survey item. A selection for afirst level risk survey item may also be a risk measure for the firstlevel risk survey item. A risk measure may include, but is not limitedto, a trend, a velocity, an indicator, a likelihood, an impact, and asum. In one or more embodiments of the invention, the plan and/or one ormore risk measures may not be presented until after the first level risksurvey item is selected. In other words, Step 306 may include more thanone selection with one or more intervening presentations based on theprevious selection. For example, an initial selection may be for thefirst level risk survey item, where a subsequent panel of the firstlevel risk survey item is presented with an option to choose the planfor the first level risk survey item or the risk measures of the firstlevel risk survey item.

In Step 308, a determination is made as to whether the selection of Step306 is a plan or risk measures of the risk survey item. If the selectionis for the plan of the risk survey item, the process proceeds to Step318. If the selection is for the risk measures of the risk survey item,the process proceeds to Step 310.

In Step 310, once one or more of the risk measures is selected the riskmeasures for the first level risk survey item are presented. Each riskmeasure and/or each first level risk survey item may be presented as arisk panel. The risk panels associated with the risk measures for thefirst level risk survey items may be presented in one of a number offormats. An example of how the risk measures for the first level risksurvey items may be presented in a number of risk panels is shown inFIG. 4B, described below. The format of the risk panels of the riskmeasures and/or first level risk survey items may be based on a defaultsetting, a user preference, or some other factor.

In Step 312, revisions to one or more risk measures for the first levelrisk survey item are received. The revisions may be received using theone or more risk panels (e.g., GUIs) on which the first level risksurvey item is presented. For example, a risk panel for the first levelrisk survey item may include a velocity element showing that thevelocity (described below) for the first level risk survey item is high.A revision may be received when, after a mouse cursor is placed overrisk panel for velocity and a pop-up window appears with choices of“slow,” “neutral,” and “fast,” a selection of “slow” is made.

In Step 314, the one or more risk measures for the first level risksurvey item are updated based on the revisions. Each risk measure may beassociated with a value so that generating an updated (revised) riskmeasure also generates an updated (revised) value associated with theupdated risk measure. The updated value may be a number, a range ofnumbers, text, a symbol, some other representation of the updated riskmeasure, or any suitable combination thereof. The updated risk measuresmay be generated using one or more algorithms, such as the algorithmsdescribed above with respect to Step 218 of FIG. 2.

In Step 316, the updated risk measures for the first level risk surveyitem are presented. In one or more embodiments of the invention, theupdated risk measures are presented in the same manner in which the riskmeasures, described above with respect to Step 304 or Step 310, arepresented. When Step 316 is complete, the process ends.

In Step 318, once the plan is selected, the plan for the first levelrisk survey item is presented. Each plan and/or each first level risksurvey item may be presented as a risk panel. The risk panels associatedwith the plan for the first level risk survey items may be presented inone of a number of formats. An example of how the plan for the firstlevel risk survey items may be presented in a number of risk panels isshown in FIGS. 10A through 10C, described below. In one or moreembodiments of the invention, a plan includes a number of tasks. Eachplan and/or each task may include, but is not limited to, a name, astatus, a due date, a description, and a driver. The format of the riskpanels of the plan and/or first level risk survey items may be based ona default setting, a user preference, or some other factor.

In Step 320, revisions to the plan for the first level risk survey itemare received. The revisions may be received using the one or more riskpanels (e.g., GUIs) on which the first level risk survey item ispresented. For example, a risk panel for the first level risk surveyitem may include one or more target measures showing elements of theplan to mitigate the first level risk survey item. In such a case, arevision may be received when text is entered into a portion of the riskpanel to add and/or edit an element of the plan.

In Step 322, the plan for the first level risk survey item is updatedbased on the revisions. An element of the plan may be associated with anumerical value so that generating an updated (revised) plan alsogenerates an updated (revised) value associated with the updated plan.The updated value may be a number, a range of numbers, a date, text, asymbol, some other representation of the updated plan, or any suitablecombination thereof. The updated plan may be generated using one or morealgorithms, such as the algorithms described above with respect to Step218 of FIG. 2.

In Step 324, the updated plan for the first level risk survey item ispresented. In one or more embodiments of the invention, the updated planis presented in the same manner in which the plan, described above withrespect to Step 304 or Step 318, is presented. When Step 324 iscomplete, the process ends.

Although the process described in FIGS. 2 and 3 is focused on thebackend system, those skilled in the art, having the benefit of thisdetailed description, will appreciate that other embodiments of theinvention may be focused on the user perspective of said process. Forexample, instead of generating and presenting a number of risk panelsand receiving a selection of a first level risk summary item (Steps 204and 206), a user navigates the risk panels and interacts with the GUIcomponents to submit a selection of a first level risk survey item.Similarly, instead of presenting a plan for the first level risk surveyitem and generating a revised plan based on receiving revisions to theplan (Steps 318, 320, and 322), a user navigates the various risk panelsand interacts with the GUI components to input and submit revisions tothe plan.

In one or more embodiments of the invention, once a risk panel isgenerated, the appearance of the risk panel may be updated at any time.In other words, new or updated risk survey items may be applied to anexisting risk panel at any time (e.g., once such a new or updated risksurvey item is received) or after any time interval. The new/updatedrisk survey items may be received and/or identified during a currentinvocation or a previous invocation of the process shown in FIG. 2 orFIG. 3. For example, one or more risk panels may be continuously updatedbased on any selection, revision, addition, or other informationreceived from any user.

FIGS. 4A and 4B show example risk panels in accordance with one or moreembodiments of the invention. As shown in FIG. 4A, a dashboard viewshows multiple risk panels that are placed in four columns. The head ofeach column is located along the top row. Specifically, the risk panelslocated along the top row in FIG. 4A (strategic (402), market/businessenv (416), financial/compliance (424), and operational (432)) are riskcategories that are available to the user based on the user informationprovided and the authority granted to that user within the enterpriserisk management system.

Further, each risk category includes a number of risk survey items, eachshown as a risk panel, organized within the risk category. The strategic(402) risk category includes risk panels for the risk survey items foroffering quality (404), employees (410), and business model & strategy(414) and may also accommodate additional risk panels, such as for risk2 (406), risk 3 (408), and risk 5 (412). The market/business env (416)risk category includes risk panels for the risk survey items forcompetitor (420) and may also accommodate additional risk panels, suchas for risk 7 (418) and risk 9 (422). The financial/compliance (424)risk category includes risk panels for the risk survey items forfinancial management (426), and may also accommodate additional riskpanels, such as for risk 11 (428) and risk 12 (430). The operational(432) risk category includes risk panels for the risk survey items forbusiness interruption (440), and may also accommodate additional riskpanels, such as for risk 13 (434), risk 14 (436), and risk 15 (438).Each risk survey item shown in FIG. 4A may be first level risk surveyitems. Further, each risk survey item includes a number of riskmeasures, described below in FIG. 4B.

In FIG. 4B, the risk panel for the first level risk survey item calledoffering quality (404) from FIG. 4A is shown. The risk panel shown inFIG. 4B includes a number of components. In FIG. 4B, each componentrepresents a risk measure. Specifically, the components of the riskpanel shown in FIG. 4B includes a trend (452), a velocity (454), alikelihood (456), an impact (458), a sum (460), and an indicator (462).Each component of the risk panel may be passive (i.e., used only todisplay information) or active (i.e., displays information and allows auser to make additions/changes to the associated risk measure).

The trend (452) component represents the importance the risk survey item(offering quality, in the case of FIG. 4B) has in the risk management ofthe enterprise. The trend (452) may have a value (e.g., number, text, orsymbol) that is determined in one of a number of ways. For example, thevalue of the trend (452) may be based on direct user information and/orother calculated or derived information. As another example, the trend(452) may be a symbol that is based in part on responses provided byusers to a question of “How important do you think this risk is to thebusiness?” and based in part on the sum (460) (described below). Thetrend (452) may be displayed in one of a number of ways. In this case,the trend (452) is displayed as an upward-facing arrow, showing that theimportance of the risk survey item is increasing. Further, the trend(452) is located in the upper left corner of the risk panel for offeringquality (404).

The velocity (454) component represents the rate at which the importance(i.e., trend) of the risk survey item is changing relative to theenterprise. In other embodiments of the invention, the velocity (454)represents the speed of onset of a risk item. The velocity (454) mayhave a value (e.g., number, text, or symbol) that is determined in oneof a number of ways. For example, the velocity (454) may be a word thatis derived from the amount of input received from users for the risksurvey item over a period of time. The velocity (454) may be displayedin one of a number of ways. In this case, the velocity (454) isdisplayed as text (i.e., slow) showing the rate at which the importanceof the risk survey item is increasing. Further, the velocity (454) inthis example is located toward the upper left corner of the risk panelfor offering quality (404)

The likelihood (456) component represents the probability that the risksurvey item will occur to impact the enterprise. The likelihood (456)may have a value (e.g., number, text, or symbol) that is determined inone of a number of ways. For example, the likelihood (456) may be anumber (e.g., an average) that is derived from numerical ratingsprovided by users giving their perceived probability that the risksurvey item will occur. The likelihood (456) may be displayed in one ofa number of ways. In this case, the likelihood (456) is displayed as anumber (i.e., 4.5) in the lower left corner of the risk panel foroffering quality (404).

The impact (458) component represents the effect that the occurrence ofthe risk survey item will have on the enterprise. The impact (458) mayhave a value (e.g., number, text, or symbol) that is determined in oneof a number of ways. For example, the impact (458) may be a number(e.g., an average) that is derived from numerical ratings provided byusers giving their perceived effect that the occurrence of the risksurvey item will have on the enterprise. The impact (458) may bedisplayed in one of a number of ways. In this case, the impact (458) isdisplayed as a number (i.e., 2.7) toward the lower left corner of therisk panel for offering quality (404).

The sum (460) component represents the net effect of the risk surveyitem. The sum (460) may have a value (e.g., number, text, or symbol)that is determined in one of a number of ways. For example, the sum(460) may be a number that is derived from one or more components (e.g.,trend (452), velocity (454), likelihood (456), impact (458)). In thiscase, the sum (460) is derived by adding the likelihood (456), and theimpact (458). The sum (460) may be displayed in one of a number of ways.In this case, the sum (460) is displayed as a number (i.e., 7.2) in thelower right corner of the risk panel for offering quality (404).

The indicator (462) component represents whether the risk survey item isconsidered to be important to monitor and mitigate. The indicator (462)may have a value (e.g., number, text, or symbol) that is determined inone of a number of ways. For example, the indicator (462) may be asymbol and/or color code that is derived from one or more components(e.g., trend (452), velocity (454), likelihood (456), impact (458)). Inthis case, the indicator (462) is derived by ranking all risk surveyitems based on the sum (460). The indicator (462) may be displayed inone of a number of ways. In this case, the indicator (462) is displayedas a symbol (i.e., star) in the upper right corner of the risk panel foroffering quality (404).

Further, the risk panel for the risk survey item may be shown in acertain color to designate the importance of the risk item to theenterprise. For example, a risk panel shown in red may indicate that thecorresponding risk survey item is likely to have a strong impact on theenterprise. Likewise, a risk panel shown in yellow may indicate that thecorresponding risk survey item has the potential to have a significantimpact on the enterprise. Other colors may be used to indicate varyingdegrees of risk that a corresponding risk item has on an enterprise.

FIG. 5 shows example risk panels in accordance with one or moreembodiments of the invention. Specifically, FIG. 5 shows multiple riskpanels with risk survey items in a hub-and-spoke configuration. The riskpanels may also include a user, a department, some other entity withinthe enterprise, or any suitable combination thereof. The risk paneldisplayed may be based on a number of factors, including but not limitedto the user, user preferences, default settings, and a selection made bythe user.

In screenshot A (510), title A (514) shows the hub-and-spoke risk panelassociated with the business unit results of the prior year. Hub 1 (512)of the risk panel is “CEO Staff 2 . . . ” designating a group underdirection of the CEO of the enterprise that is assigned to assess andmanage various risk survey items. A total of 16 different risk surveyitems surround hub 1 (512), but only 6 (i.e., Risk 16, Risk 3, Risk 4,Risk 6, Risk 9 and Risk 11) have spokes that connect to hub 1 (512). Thespokes exist only for the risk survey items that are deemed to be ofgreatest importance for the enterprise.

In screenshot B (520), title B (524) shows the hub-and-spoke risk panelassociated with the entire enterprise. As in screenshot A (510), hub 2(522) of the risk panel in screenshot B (520) is “CEO Staff 2 . . . ”.While the same 16 different risk survey items surround hub 2 (522), here11 (i.e., Risk 3, Risk 4, Risk 5, Risk 6, Risk 7, Risk 9, Risk 10, Risk11, Risk 13, Risk 15, and Risk 16) have spokes that connect to hub 2(522). Different indicators are used to indicate the risk survey itemsthat are deemed to be of greatest importance (red) and medium importance(yellow) for the enterprise. Other ways of showing the risk importanceindicator may include, but are not limited to, text and a symbol.

In screenshot C (530), title C (534) shows the hub-and-spoke risk panelfor the aggregation of the results from all business units of theenterprise. Hub 3 (532) of the risk panel is “IFID 2010 ( . . . ”designating a group within the enterprise that is assigned to assess andmanage various risk survey items. Each of the total of 16 different risksurvey items that surround hub 3 (532) have spokes that connect to hub 3(532). The circles representing the risk survey items are coloredaccording to the importance of risk to the enterprise. For example, thehighest priority risk survey items Risk 1, Risk 3, Risk 4, Risk 11, Risk12, Risk 16 are indicated by a red circle. The medium priority risksurvey items are Risk 8 and Risk 14 are indicated by a yellow circle.Other ways of showing the risk importance indicator may include, but arenot limited to, text and a symbol. Further, the lowest priority risksurvey items (i.e., Risk 2, Risk 5, Risk 6, Risk 7, Risk 8, Risk 9, Risk10, Risk 13, Risk 14, and Risk 15) are shown in gray and have no spokeconnecting them with hub 3 (532).

In screenshot D (540), title D (544) shows the hub-and-spoke risk paneldisplay of a company-wide aggregation of the enterprise. As inscreenshot C (530), hub 4 (542) of the risk panel is “IFID 2010 ( . . .”. The 16 different risk survey items are the same as in screenshot C(530), and the risk survey items that surround hub 4 (542) that havespokes that connect to hub 4 (542) represent the risk survey items ofgreatest importance and of medium importance to the entire enterprise.Further, the circles representing the risk survey items are colored thesame (i.e., have the same importance of risk to the enterprise) as inscreenshot C (530). Other ways of showing the risk importance indicatormay include, but are not limited to, text and a symbol.

FIGS. 6A and 6B show an example risk panel in accordance with one ormore embodiments of the invention. Specifically, FIG. 6A shows a riskpanel of second level risk survey items (614) based on selection of the“offering quality” first level risk survey item from FIG. 4A. The riskpanel of FIG. 6A includes a number of active and passive components.Among the passive components of the risk panel are a title of the firstlevel risk survey item (606), instructions (608), a description of thefirst level risk survey item (610) (here, in the form of a question), alikelihood question (616), an impact question (626), and a sum (634)(here, adding the ratings given by the user in response fields 1 and 2(620, 630)). These passive components merely provide information to theuser to help the user complete the items of the risk panel.

The second level risk survey items (614) each are accompanied by acheckbox so that the user may select one or more second level risksurvey items. If the user has additional second level risk survey itemsto add or has additional comments, the user may select the editcapability (612) to add the items or comments. The user is alsopresented with response field 1 (620) to answer the likelihood question(616) and response field 2 (630) to answer the impact question (626).Response field 1 (620) and response field 2 (630) use a dropdown menu toprovide the user with a list of potential answers. If the user needs anexplanation of the likelihood question (616), the impact question (626),and/or the potential answers in response field 1 (620) and responsefield 2 (630), the user may select the link to explanation (618) to betransferred to the risk panels shown in FIG. 6B.

In FIG. 6B, three different panels are shown. At the top of FIG. 6B, arating key (650) is shown. The rating key (650) describes how the numberratings are defined for both the impact and the likelihood. The secondpanel lists the impact criteria (652). In this example, each of theitems in the impact criteria (652) includes at least two explanatorypoints to clarify the corresponding item. The final panel lists thelikelihood criteria (654) in a fashion similar to the way in which theimpact criteria (652) are listed.

Continuing with FIG. 6A, once the user has finished completing the riskpanel, the user may save the responses by activating (e.g., clicking on)the save button (636). Other components to the risk panel of FIG. 6A mayalso be included. For example, a button may allow the user to clear allfields on the risk panel.

FIG. 7 shows an example risk panel in accordance with one or moreembodiments of the invention. Specifically, FIG. 7 shows a risk panelwith first level risk survey items (710) in a hub-and-spokeconfiguration for a particular user (704). The title (702), summary(706), and legend (712) are passive components of the risk panel toexplain the contents of the risk panel.

The user (704) and first level risk survey items (710) are activecomponents of the risk panel in that the user may select a first levelrisk survey item and move the selected first level risk survey item tothe hub, so that the display will reconfigure to show how the selectedfirst level risk survey item is associated with other first level risksurvey items, the user (704), and other users. Further, the modificationbutton (716) and the finalization button (720) allow the user (704) tochange or make no further changes, respectively, to the first level risksurvey items (710). Other components to the risk panel of FIG. 7 mayalso be included. For example, a button may allow the user to view asummary of all first level risk survey items.

FIG. 8 shows an example risk panel in accordance with one or moreembodiments of the invention. Specifically, FIG. 8 shows a risk panelwith a summary of values for all first level risk survey items (710) intabular form. The table includes the risk area (802) column, whichincludes a list of the first level risk survey items. The risk area(802) column also includes the impact and likelihood values for eachfirst level risk survey item. The trend/velocity (804) column of thetable includes the trend and velocity values for each of the first levelrisk survey items. The top issues (806) column of the table includes themost relevant issues for each of the first level risk survey items.

FIGS. 9A through 9C show example risk panels in accordance with one ormore embodiments of the invention. Specifically, FIG. 9A shows a riskpanel (902) of a first level risk survey item entitled “Employees,”similar to the “Employees” first level risk survey item shown in FIG.4A. Here, the risk panel (902) includes a trend value indicator (906)for the risk item. Further, the risk panel (902) includes a pushbutton(904) to access the plans for the risk measures of trend, velocity, andrelated metrics for the first level risk survey item. By selecting thepushbutton (904), a new risk panel, such as the risk panel shown in FIG.9B, may be presented.

In FIG. 9B, a risk panel is presented with several components. The title(912) and summary (914) are passive components that describe the firstlevel risk survey item and the trend driver, respectively. The targetmeasure(s) (918) lists the goals that are sought to be achieved tomitigate the risk item. The actual measure(s) (920) lists the actualperformance of each of the goals. In FIG. 9B, the target measure(s)(918) and the actual measure(s) (920) are passive components of the riskpanel.

At the right side of FIG. 9B, a list of owner(s) (922) of the risksurvey item are displayed. Each owner (922) may be shown by name,picture, employee identification number, some other suitable means ofidentification, or any combination thereof. In one or more embodimentsof the invention, a user may click on an identification component (e.g.,picture) of an owner (922) to communicate with the owner (922). Forexample, clicking on the name of an owner (922) may begin an instantmessage chat with the owner (922) selected. In such embodiments of theinvention, a user may ask questions, seek advice, and/or otherwisecollaborate regarding a plan to mitigate the risk survey item.

To exit the risk panel of FIG. 9B, the user may select the close button(926) at the lower right of the risk panel. To add and/or modify thetarget measures (918) and/or the actual measures (920), the user mayselect the edit button (924). By selecting the edit button (924), a newrisk panel, such as the risk panel shown in FIG. 9C, is presented.

In FIG. 9C, a risk panel similar to the risk panel of FIG. 9B ispresented. Aside from the title (962), the components of FIG. 9B thatwere passive are now active components in FIG. 9C. Specifically, thesummary (964) of FIG. 9C is now editable in the event that the trenddriver has changed. Further, the target measures (968) and the actualmeasures (970) may be edited, deleted, or added. Likewise, an owner(972) can be changed, deleted, or added.

In addition, the risk panel of FIG. 9C allows a user to modify the risktrend using the trend response (952) component at the far left side ofthe risk panel. An archive (954) is also shown to allow a user to viewchanges that have been made over time to the plan for the risk surveyitem. A user may save any changes made to the plan for the risk surveyitem by selecting the save button (974). The user may also cancel anychanges made to the plan for the risk survey item by selecting thecancel button (976).

FIGS. 10A through 10C show example risk panels in accordance with one ormore embodiments of the invention. Specifically, FIG. 10A shows a title(1002) of the risk panel. Here, the title (1002) indicates that the riskpanel describes plans for the first level risk survey item entitled“Employees.” The target question (1004) provides focus to the user as tothe issue regarding the risk survey item. The focus items (1006) listthe one or more top issues to address with the plan. The title (1002),target question (1004), and the focus items (1006) are all passivecomponents to the risk panel of FIG. 10A.

The return link (1008), once selected, allows the user to return to adisplay showing risk panels of the top risk survey items. The expandbutton (1010), once selected, provides detail behind each plan (e.g.,plan X (1024)) for the risk survey item. An example of the risk panelthat follows the selection of the expand button (1010) is shown in FIG.10C below. In order to expand only a single plan, an expansion button(e.g., plan X expansion button (1020)) associated with the single planmay be selected. Further, each plan includes a plan status indicator(e.g., plan X status indicator (1022)) to show whether a plan is onschedule, completed, yet to begin, behind schedule, or some othersuitable status of the plan. The plan status indicator may be shown in anumber of ways. In FIG. 10A, the plan status indicator is shown bycolor. Other ways of showing the plan status indicator may include, butare not limited to, text and a symbol.

To add a plan, an add button (1012) may be selected. Upon selecting theadd button (1012), a risk panel, such as the risk panel shown in FIG.10B, is presented. The risk panel of FIG. 10B includes a number offields to allow a user to add a plan. Specifically, the risk panel ofFIG. 10B includes active components such as a plan name field (1030), aplan driver field (1032), a completion date field (1034), a descriptionfield (1036), one or more issues addressed (1038) checkboxes, and astatus field (1040). Each of the plan name field (1030), the plan driverfield (1032), the completion date field (1034), the description field(1036), the issues addressed (1038) checkboxes, and the status field(1040) may be configured to receive information from a user in one of anumber of ways, including but not limited to free-form text, a checkbox, selection from a dropdown list, selection of a radio button, or anyother suitable means of providing information about the new plan.

A new plan for the risk survey item may be saved by selecting the savebutton (1042). A new plan may be abandoned prior to adding the new planto the existing plans for the risk survey item by selecting the cancelbutton (1044).

FIG. 10C shows a portion of an example risk panel with all plan detailsfor a risk survey item expanded. Each plan (e.g., plan 1 (1060)) islisted by name. Also included with each plan is the completion date(e.g., completion date (1062)) for the plan, the description of the plan(e.g., description (1064)) of the plan, the issues addressed (e.g.,issues addressed (1066)) for the plan, the status (e.g., status (1068))of the plan, and the plan driver (e.g., plan driver (1070)) of the plan.Each of the aforementioned components of the risk panel may be passive.However, one or more of the aforementioned components of the risk panelmay become active by selecting the edit button (e.g., edit button(1072)) for the plan.

As in FIG. 10A, the risk panel of FIG. 10C includes a status indicator(e.g., plan 1 status indicator (1076)) to show the status of the plan.The risk panel also includes a compression button (e.g., plan 1compression button (1074)) that hides all of the components of the planexcept for the name of the plan (e.g., plan 1 (1060)) and the planstatus indicator (e.g., plan 1 status indicator (1076)). Further, afterthe compression button (e.g., plan 1 compression button (1074)) isselected, the compression button (e.g., plan 1 compression button(1074)) changes to a expansion button (not shown), similar to theexpansion button described above with respect to FIG. 10A.

FIGS. 11A through 11C show example risk panels in accordance with one ormore embodiments of the invention. Specifically, FIGS. 11A through 11Ceach show a risk panel presented in tabular form. In FIG. 11A, a portionof the risk panel includes a summary in tabular form for plans a numberof first level risk survey items. In one or more embodiments of theinvention, all components of the risk summary table shown in FIG. 11Aare passive. For example, at the top of FIG. 11A, the title (1102) is“Plans for Offering Quality.” Top issues (1104) associated with the planfor the risk survey item are displayed below the title (1102).

The table for the plans for offering quality includes a number ofcolumns for each plan. The first column is the plan name (1106),followed by the status (1108), which in this example shows the status ofeach plan as a colored circle and in text. The completion date (1110)column shows the completion date (actual or projected) of the plan. Theplan driver (1112) shows the driver of the plan. The description (1114)describes the plan, and the issues addressed (1116) lists one or moreobjectives of the plan. The tabular form of the risk panel provides aneasy reference to a user interested in a plan for a risk survey item.

FIG. 11B shows a portion of a risk panel of an archive for a risk surveyitem. Specifically, FIG. 11B shows a portion of the risk panel for anarchive record of a first level risk survey item (in this case,“employees”) in tabular form. In one or more embodiments of theinvention, all components of the risk summary table shown in FIG. 11Bare passive. For example, at the top of FIG. 11B, the title (1140) is“Archives for Employees.” Target measures (1142) associated with therisk survey item are displayed below the title (1140). One or more ofthe target measures (1142) may be the same as, or related to, a riskmeasure of the risk survey item.

The table for the archives for the risk survey item includes a columnfor the archive date (1144) to display when the archive was created,when the record associated with the archive was active, or some othersuitable measure of the archive date. The archive date, which may be apoint in time, a range of times, or “current.” The trend (1146) columnof the table gives the value of the trend for the risk survey item forthe archive record.

The trend driver (1148) column shows what factor(s) drove the trendduring the period of time of the archived record. The actual measure(1150) column shows actual metrics (performance values) relative to thetarget measures (1142) during the period of time of the archived record.

FIG. 11C shows a risk panel of a summary, in tabular form, of the risksurvey items of the highest importance to an enterprise. In one or moreembodiments of the invention, all components of the risk summary tableshown in FIG. 11C are passive. For example, at the top of FIG. 11C, thetitle (1160) is “[Example] Top Risks.” The top risk (1162) column liststhe risk survey items that are currently perceived as being of thehighest importance. The owner (1164) column lists the owner or owners ofthe risk survey item.

The risk trend (1166) column shows the current trend of the risk surveyitem. The trend driver (1168) column shows what factor(s) are drivingthe trend of the risk survey item. The target measure (1170) columnshows the target or desired performance metrics that are used toevaluate the plan to mitigate the risk survey item. The actual measure(1172) column shows the actual metrics (performance values) relative tothe target measures (1170) for the risk survey item.

FIG. 12 shows a computer system (1200) on which one or more embodimentsof a system (e.g., the consumer system, an applicant system, a socialsource system, an underwriter system, a merchant pool system, asdescribed above with respect to FIG. 1) may be implemented. The computersystem (1200) of FIG. 12 may be virtually any type of computerregardless of the platform being used. For example, as shown in FIG. 12,the computer system (1200) includes one or more processor(s) (1202) suchas an integrated circuit, a central processing unit (CPU), or otherhardware processor, associated memory (1204) (e.g., random access memory(RAM), cache memory, flash memory, etc.), a storage device (1206) (e.g.,a hard disk, an optical drive such as a compact disk drive or digitalvideo disk (DVD) drive, a flash memory stick, etc.), and numerous otherelements and functionalities typical of today's computers (not shown).The computer system (1200) may also include input means, such as akeyboard (1208), a mouse (1210), or a microphone (not shown). Further,the computer system (1200) may include output means, such as a graphicaldisplay (1212) (e.g., a liquid crystal display (LCD), a light-emittingdiode (LED) display, a plasma display, or cathode ray tube (CRT)monitor). The computer system (1200) may be connected to a network(1214) (e.g., a local area network (LAN), a wide area network (WAN) suchas the Internet, or any other similar type of network) via a networkinterface connection (not shown). Many different types of computersystems exist, and the aforementioned input and output means may takeother forms, now known or later developed. Generally speaking, thecomputer system (1200) includes at least the minimal processing, input,and/or output means necessary to practice embodiments of the invention.

Further, one or more elements of the aforementioned computer system(1200) may be located at a remote location and connected to the otherelements over a network. Further, embodiments of the invention may beimplemented on a distributed system having a plurality of nodes, whereeach portion of the invention (e.g., survey generator, survey analyzer,enterprise risk manager) may be located on a different node within thedistributed system. In one or more embodiments of the invention, thenode corresponds to a computer system. Alternatively, the node maycorrespond to a processor with associated physical memory. The node mayalternatively correspond to a processor with shared memory and/orresources. Further, software instructions to perform embodiments of theinvention may be stored on a non-transitory computer readable storagemedium such as a compact disc (CD), a diskette, a tape, or any otherphysical computer readable storage device.

Embodiments of the invention may allow a user to manipulate and viewcurrent and historical information for each risk. Further, the riskinformation for the risks within embodiments of the invention areupdated and displayed on a real-time basis to provide a user with themost up-to-date risk information available. Further, embodiments of theinvention provide a user with a single source to perform end-to-end riskmanagement activities enabling business units across an enterprise toeffectively and efficiently identify, assess, manage, and monitor toprisks (i.e., risks that most strongly impact a business unit and/orenterprise).

Embodiments of the invention integrate risk management data on areal-time basis with a risk management user interface (e.g., GUI) topresent top risks and provide the functionality to add, delete, archive,and/or edit risk data. Embodiments of the invention also allow a user toreport current and historical risk information. Further, embodiments ofthe invention seamlessly integrates risk identification, assessment,planning, monitoring, archiving, analyzing, and reporting into a single,easy-to-use tool. Embodiments of the invention capture current andhistorical risk trends (e.g., increasing, decreasing, stable), velocityor speed of onset of a risk (e.g., fast, slow), metrics, planning, andreporting.

While the invention has been described with respect to a limited numberof embodiments, those skilled in the art, having benefit of thisdisclosure, will appreciate that other embodiments can be devised whichdo not depart from the scope of the invention as disclosed herein.Accordingly, the scope of the invention should be limited only by theattached claims.

What is claimed is:
 1. A method for managing risk of an enterprise,comprising: generating, by a risk assessment application executing on aprocesser of a computing system and using a plurality of risk surveyresponses, a plurality of risk panels for a plurality of first levelrisk survey items; presenting the plurality of risk panels for each ofthe plurality of first level risk survey items; receiving, by the riskassessment application, a first selection to edit a first risk panel ofthe plurality of risk panels for a first level risk survey item of theplurality of first level risk survey items, wherein the first risk panelcomprises a first indicator passive graphical user interface (GUI)component, and wherein the first indicator passive GUI componentcomprises a symbol derived from a risk measure of a first level risksurvey item for the first risk panel; receiving a second selection ofthe first level risk survey item after the first selection and beforereceiving selection of a different first level risk survey item;presenting, in response to the second selection, a second risk panel ofthe plurality of risk panels for a plurality of second level risk surveyitems, wherein the second risk panel comprises a plurality of active GUIcomponents; receiving, using the second risk panel, additional risksurvey responses for one of the second level risk survey items of theplurality of second level risk survey items; updating, based on theadditional risk survey responses and using a computer processor, theplurality of risk panels for the first level risk survey item togenerate a plurality of revised risk panels; updating, based on arevision to the risk measure from updating the plurality of risk panels,the first indicator passive GUI component of the first risk panel togenerate a revised indicator passive GUI component comprising a revisedsymbol, wherein the risk measure is a sum of a value of an impact and avalue of a likelihood, wherein the likelihood is generated using astatistical algorithm; and presenting the plurality of revised riskpanels for the plurality of first level risk survey items.
 2. The methodof claim 1, further comprising: determining that a value of the riskmeasure associated with the first risk panel of the first level risksurvey item exceeds a threshold value; and sending a notification thatthe value of the risk measure exceeds the threshold value.
 3. The methodof claim 2, wherein the risk measure comprises at least one of a groupconsisting of a trend, a velocity, a metric, a likelihood, an impact, asum, and an indicator.
 4. The method of claim 2, wherein the value ofthe risk measure is presented as at least one of a group consisting of anumber, a symbol, and text.
 5. The method of claim 1, wherein the secondrisk panel comprises a plan to further provide guidance to the user toreduce a value of the risk measure of the first level risk survey itembelow a threshold value, wherein the plan comprises a plurality oftasks.
 6. The method of claim 5, further comprising: determining that adue date for a task of the plurality of tasks associated with the planhas passed; and sending a notification that the due date to complete thetask has passed.
 7. The method of claim 1, wherein the plurality offirst level risk survey items is assigned to a general risk heading of aplurality of general risk headings.
 8. The method of claim 1, whereinthe plurality of risk panels is presented to a plurality of users withinthe enterprise, wherein each of the plurality of users is responsiblefor at least one first level risk survey item of the plurality of firstlevel risk survey items.
 9. The method of claim 1, wherein the firstrisk panel is presented in a first hub-and-spoke format, wherein thefirst hub-and-spoke format comprises the first level risk survey item ata first hub and a first remainder of the plurality of first level risksurvey items connected to the first hub using a first plurality ofspokes.
 10. The method of claim 9, wherein the first hub-and-spokeformat is transformed to a second hub-and-spoke format by receiving aselection of a different first level risk survey item as a second hub,wherein the second hub is connected to a second remainder of theplurality of first level risk survey items by a plurality of spokes,wherein the first remainder of the plurality of first level risk surveyitems comprises the different first level risk survey item, and whereinthe second remainder of the plurality of first level risk survey itemscomprises the first hub.
 11. A system for managing risk of anenterprise, comprising: a hardware processor; and a risk assessmentapplication executing on the hardware processor and configured to:receive a plurality of risk survey responses, generate, based on theplurality of risk survey responses, a plurality of risk panels for eachof a plurality of first level risk survey items, present the pluralityof risk panels for the plurality of first level risk survey items,receive a first selection to edit a first risk panel of the plurality ofrisk panels for a first level risk survey item of the plurality of firstlevel risk survey items, wherein the first risk panel comprises a firstindicator passive graphical user interface (GUI) component, and whereinthe first indicator passive GUI component comprises a symbol derivedfrom a risk measure of a first level risk survey item for the first riskpanel, receive a second selection of the first level risk survey itemafter the first selection and before receiving selection of a differentfirst level risk survey item, present, in response to the secondselection, a second risk panel of the plurality of risk panels for aplurality of second level risk survey items, wherein the second riskpanel comprises a plurality of active GUI components, receive, using thesecond risk panel of the plurality of risk panels, additional risksurvey responses for one of the second level risk survey items of theplurality of second level risk survey items, update, based on theadditional risk survey responses, the plurality of risk panels for thefirst level risk survey item to generate a plurality of revised riskpanels, update, based on a revision to the risk measure from updatingthe plurality of risk panels, the first indicator passive GUI componentof the first risk panel to generate a revised indicator passive GUIcomponent comprising a revised symbol, wherein the risk measure is a sumof a value of an impact and a value of a likelihood, wherein thelikelihood is generated using a statistical algorithm, and present theplurality of revised risk panels for the plurality of first level risksurvey items.
 12. The system of claim 11, wherein: the risk assessmentapplication is further configured to: determine that a value of the riskmeasure associated with a risk summary panel of the first level risksurvey item exceeds a threshold value, and send a notification that thevalue of the risk measure exceeds the threshold value, wherein the riskmeasure comprises at least one of a group consisting of a trend, avelocity, a metric, a likelihood, an impact, a sum, and an indicator.13. The system of claim 11, wherein: the risk assessment application isfurther configured to: determine that a due date for a task of aplurality of tasks associated with a plan has passed, present a risksummary panel comprising the plan to further provide guidance to theuser to reduce a value of the risk measure of the first level risksurvey item below a threshold value, and send a notification that thedue date to complete the task has passed.
 14. The system of claim 11,wherein: the risk assessment application is further configured to: mapeach of the plurality of first level risk survey items to a general riskheading of a plurality of general risk headings, and present, on thesecond risk panel, the plurality of general risk headings and theplurality of first level risk survey items mapped to each general riskheading.
 15. The system of claim 11, wherein: the risk assessmentapplication is further configured to: receive a third selection of thefirst level risk survey item; present, on a third risk panel, theplurality of first level risk survey items in a first hub-and-spokeformat comprising the first level risk survey item at a first hub and afirst remainder of the plurality of first level risk survey itemsconnected to the first hub using a first plurality of spokes; receive afourth selection of a different first level risk survey item, whereinthe first remainder of the plurality of first level risk survey itemscomprises the different risk level risk survey item; and present, on afourth risk panel, the plurality of first level risk survey items in asecond hub-and-spoke format comprising the different first level risksurvey item at a second hub and a second remainder of the plurality offirst level risk survey items connected to the second hub using a secondplurality of spokes, wherein the second remainder of the plurality offirst level risk survey items comprises the first hub.
 16. The system ofclaim 11, wherein the plurality of risk panels presented by the riskassessment application is based on a plurality of characteristicsassociated with a user.
 17. The system of claim 11, further comprising:a survey generator executing on the hardware processor and comprised inthe risk assessment application, wherein the survey generator isconfigured to generate a risk survey used to receive plurality of risksurvey responses; and a survey input module executing on the hardwareprocessor and comprised in the risk assessment application, wherein thesurvey input module is configured to send a request to a plurality ofusers to complete the risk survey.
 18. A non-transitory computerreadable medium comprising computer readable program code embodiedtherein for performing a method for managing risk of an enterprise,comprising: generating, by a risk assessment application executing on aprocesser of a computing system and using a plurality of risk surveyresponses, a plurality of risk panels for a plurality of first levelrisk survey items; presenting the plurality of risk panels for each ofthe plurality of first level risk survey items; receiving, by the riskassessment application, a first selection to edit a first risk panel ofthe plurality of risk panels for a first level risk survey item of theplurality of first level risk survey items, wherein the first risk panelcomprises a first indicator passive GUI component, and wherein the firstindicator passive GUI component comprises a symbol derived from a riskmeasure of a first level risk survey item for the first risk panel;receiving a second selection of the first level risk survey item afterthe first selection and before receiving selection of a different firstlevel risk survey item; presenting, in response to the second selection,a second risk panel of the plurality of risk panels for a plurality ofsecond level risk survey items, wherein the second risk panel comprisesa plurality of active GUI components; receiving, using the second riskpanel, additional risk survey responses for one of the second level risksurvey items of the plurality of second level risk survey items;updating, based on the additional risk survey responses and using acomputer processor, the plurality of risk panels for the first levelrisk survey item to generate a plurality of revised risk panels;updating, based on a revision to the risk measure from updating theplurality of risk panels, the first indicator passive GUI component ofthe first risk panel to generate a revised indicator passive GUIcomponent comprising a revised symbol, wherein the risk measure is a sumof a value of an impact and a value of a likelihood, wherein thelikelihood is generated using a statistical algorithm; and presentingthe plurality of revised risk panels for the plurality of first levelrisk survey items.
 19. The non-transitory computer readable medium ofclaim 18, further comprising: determining that a value of the riskmeasure associated with the first risk panel of the first level risksurvey item exceeds a threshold value; and sending a notification thatthe value of the risk measure exceeds the threshold value.
 20. Thenon-transitory computer readable medium of claim 18, further comprising:determining that a due date for a task of a plurality of tasksassociated with a plan has passed; and send a notification that the duedate to complete the task has passed, wherein the second risk panelcomprises the plan to further provide guidance to a user to reduce avalue of the risk measure of the first level risk survey item below athreshold value, wherein the plan comprises the plurality of tasks.